Is it acceptable for spouses to view each other's claim information on a TPA website with only an opportunity for each spouse to object to this use of their PHI?

[Guest Cgross]

We're setting up a web site for our groups to view claim information on-line.

We are considering using a check box to allow an individual to object

to any other family member viewing their claim information, and not requiring

a signed authorization to allow them to do so. (In other words they have to

opt-out of this arrangement.) I have reviewed CFR 164.510 and believe

we have a valid argument in doing so.

Does anyone have experience with this sort of arrangment? Thanks.

[Guest kowen]

I would suggest not doing so. My understanding of 164.510 is that the disclosure to a family member must be directly relevent to their involvement with the undividual's care or payment for health care. You could become a problem in divorce cases where the indivual wouldn't want a soon to be ex-spouse to view information.

[Steve72]

I agree that this would be a violation of the rule as drafted. However, it does appear to comply with Medicare's own procedures for accessing information. HHS has done a couple things that, in my opinion, violate the letter of the law of HIPAA (permitting temporary verbal authorizations and spousal access as described, for example).

The safest route is to follow Kowen's advice. If the employer determines that this would create an administrative nightmare, they may be able to put forward an argument that HHS has permitted this type of process for its own covered entity functions.

[Jbentz]

This is a gray area depending on which family member has access. The employee, or the guarantor, can fall under the payment definition, but other family members, and each situation is tricky and most would not fall under that provision. I would be using a HIPAA compliant authorization for the release so you are violating thier rights. If not, spouses, college age children, and emancipated minors could be real issues. You can also run up against state laws protecting minors and certain treatment issues (STDs, etc...)

[Guest SillyWilly]

I would have each individual set up under their own account and only have access to their account.